HopeHealth Data Breach Investigation

Recently, HopeHealth announced that it had experienced a data breach in which sensitive personal identifiable information and protected health information in its care may have been compromised. According to the breach notice shared on its website, on March 20, 2025, HopeHealth became aware of suspicious activity in its network environment.¹ As a result, HopeHealth launched an investigation to determine the nature of the incident.

Through its investigation, HopeHealth confirmed that sensitive personal information in its systems may have been accessed and acquired by an unauthorized third party between March 19 and March 20, 2025. As a result, HopeHealth began a review of the data to determine what information had been impacted as well as identify the specific individuals affected. On November 21, 2025, HopeHealth completed this review. While the information impacted varies depending on the individual, the type of information potentially exposed includes:

• Name
• Social Security number
• Address
• Date of birth
• Username and password
• Driver’s license number
• State identification card number
• Birth certificate
• Prescription information
• Mental or physical condition
• Mental or physical treatment
• Clinical information
• Health insurance information
• Medical record number
• Patient number
• Other ID number
• Credit/debit card number
• Credit/debit card expiry
• Date of service
• Lab results

On December 4, 2025, HopeHealth posted notice of the breach on its website. Additionally, HopeHealth began mailing data breach notification letters to impacted individuals. Based on the website breach notice, HopeHealth is providing affected individuals with a list of the specific types of sensitive information impacted and complimentary credit monitoring services. A link to the website breach notice is below.